feat(hardening): rate limit (signup/reset/bookings) + tâches cron + backup PostgreSQL nocturne

src/app/api/password/reset-request/route.ts

@@ -5,6 +5,7 @@ import { createPasswordResetToken } from "@/lib/password-reset";
 import { prisma } from "@/lib/prisma";
 import { sendPasswordReset } from "@/lib/email";
 import { recordAudit } from "@/lib/admin/audit";
+import { rateLimitRequest } from "@/lib/rate-limit";
 
 export const runtime = "nodejs";
 
@@ -15,6 +16,13 @@ const schema = z.object({
 const SITE_URL = process.env.NEXT_PUBLIC_SITE_URL ?? "https://karbe.cosmolan.fr";
 
 export async function POST(req: Request) {
+  const rl = rateLimitRequest(req, "password-reset", 60 * 60 * 1000, 3);
+  if (!rl.ok) {
+    return NextResponse.json(
+      { error: `Trop de tentatives. Réessayez dans ${rl.retryAfter}s.` },
+      { status: 429, headers: { "Retry-After": String(rl.retryAfter) } },
+    );
+  }
   let body: unknown;
   try {
     body = await req.json();